非營利單位資訊災難備援機制建置之雛形研究

Abstract

隨著近年來資訊科技的發展，導入資訊技術以提昇組織效率與競爭力已經是全球的趨勢。而在近年來全球資訊安全事件不斷發生，資訊犯罪手法不翻新，為保護組織內部資訊相關資產並保持組織持續運作，導入資訊安全管理系統（Information Security Management System ，簡稱ISMS）便是一套可有效控制管理之方法。國際間建構資訊安全管理系統通常採用BS7799 與ISO/IEC17799 資訊安全管理規範為標準，以此標準來管理組織內部資訊的運用、資訊硬體的安全以及資訊使用者的控管，以達成資訊資產的「機密性」、「完整性」及「可用性」。本研究以個案研究方式，對一正以BS7799 標準導入資訊安全管理系統之非營利機構進行訪談與實地觀察，探討其組織特質及資訊安全管理政策，並以該個案為參考來適切地規劃一個非營利機構的資訊回復及災難備援機制。

Applying information technology to promote the organization efficiency and competitiveness will be the development trend in recent years. Information Security Management System (ISMS) had been known as a way to keep and protect the stable and continuous operation of the information assets for most organizations. BS7799 and ISO/IEC17799 will be the international standard frequently used to construct the information security management security for most organizations. Applying BS7799 and ISO/IEC17799 to manage the application of information, the safety of hardware and the right of users will reach “Confidentiality”, “Integrity” and “Availability” of information assets. This research uses case study technique to investigate a nonprofit organization which applying the ISMS based on BS7799 standard. The ISMS will be initially discussed, and the information recovery mechanism process will be then constructed in this study. The information assets can be protected, built and recovery at the shortest time by using the constructed information recovery mechanism process when information security events happen.